Tag: Self-Hosting

Posted on
by

Yahoo Groups is shutting down, taking years’ worth of users’ writing and discussions with it. It’s the latest reminder that if you don’t host it yourself, your stuff is at the mercy of someone else’s business decisions. Or whims.

And yet…

My old blog posts are full of dead links to sites where people were hosting their own stuff, but it’s gone now. I’m sure some was taken down deliberately, but I’m sure there’s also a lot that was lost because they couldn’t maintain it.

Self-hosting isn’t just a matter of knowledge. It’s a matter of time. It’s a matter of being able to update things that need to be changed (like TLS certs or software). And there are ongoing costs: Domain name registration. Hosting service, if you’re using a hosting provider. Bandwidth if you’re using your own server.

And if for some reason you can’t keep those ongoing costs going, guess what? Your stuff goes offline. But you’re still on Facebook!

There’s a character in Les Misérables, Pere Mabeuf, who gets left out of most adaptations. He’s an old man who, for a time, eked out a living from a book he’d published years earlier. Eventually he’s so strapped for cash that he has to sell the printing plates, so even if someone wanted to buy a print run, he couldn’t do it. Essentially, he was self-hosting his work until he couldn’t afford to anymore.

Imagine one of these scenarios:

  • You’ve got some nice photo gallery or CMS, and you can afford the storage and bandwidth…and then financial trouble hits.
  • You have a site for a hobby that you don’t keep up with anymore. You don’t mind leaving it online, but it gets to be a pain to keep going, and starts feeling like it’s not worth the effort.
  • You die, and your family has to decide how long to leave the FreedomBox plugged into the network.

On one hand, a social network site might close down like Google+, purge accounts like Tumblr, change pricing drastically like Flickr, lock down access like Instagram or Photobucket, change their algorithms for what people see like Facebook… On the other, you can keep using a service like Mastodon or Twitter or Facebook even if you lose the resources to maintain your software, your VPS, your internet connection that allows incoming HTTPS, etc.

The trade-off is not just convenience vs. control. It’s host your own stuff to protect it from the whims and misfortune of (and exploitation by) third-party services. Or use the cheap/free third-party services to protect your stuff from your own misfortune.

I still think, on balance, it’s better to host your own online presence if you can, at least the parts you want to be long-term. Have your conversations where other people are, and put your art or work somewhere you control. But as a backup, I think every CMS should incorporate an “Export to static site” feature*. That way, you (or your next of kin) can quickly produce a fully-functional static site to toss on cheap shared hosting as an archive.

*You can use wget -m in a pinch, but you probably also want to remove things like comment forms in the process.

Posted on
by

I’ve been thinking about what it means to self-host a service, and that there are degrees even within that.

I have a self-hosted WordPress blog in the sense that I manage an installation of WordPress, but I run it on a VPS at a web host. It’s not as self-hosted as someone running a server on a Lollipop Cloud or FreedomBox, but it’s more self-hosted than someone using WordPress.com. It’s also more self-hosted than someone using the managed WordPress hosting at the same web host.

The key advantages of self-hosting are privacy and control. Unless a service uses end-to-end encryption, the admins at each level can probably read your stuff – you have to trust that they won’t do it unless they have to.

And of course when you run your own service, you don’t have to fear losing control when Google Plus shuts down, or Flickr changes their pricing structure, or Tumblr changes their TOS, or MySpace botches a server migration.

The obvious disadvantage of self-hosting, of course, is that you’re on the hook for all the maintenance. Spam filtering, moderation, security updates, server migrations – those are all on you.

And unless you’re using your own software, even on your own box there’s still the risk that a project is going to shut down & leave you without security fixes, or pivot to a new direction that no longer fits what you want. (So glad WP’s block editor is still optional!)

I’ve settled on a balance where I manage the top-level web apps, but my webhost handles the hardware, the virtualization and the LAMP stack. (And email. Ugh, I’d forgotten how much of a pain a mailserver can be to handle until I tried to set one up on a Raspberry Pi a couple of months ago.)

I guess I’m kind of splitting the difference. 🤷

Posted on
by

In advance of Google shuttering their third(?) attempt at a social network, Google+, I’ve retrieved a full archive, and I’ve trawled through it looking for anything that I want to keep online after the shutdown. Most of them were cross-posts of one sort or another, or (early on, especially) the kind of random social media status that maybe has value in the moment, but not down the line. I found around 30-40 posts worth keeping. Some had their own merits, some fit in with other posts here on the blog.

Rather than just import them verbatim, I’ve decided to do some minimal cleanup. No major rewriting or anything, just the kind of things that I’d be willing to silently change on an old blog post that was already here:

  • Fix up the formatting
  • Fix typos
  • Link to related posts
  • Add a quote to linkblogging posts if they need more context

Yeah, it’s slower than copy-paste or direct import (I never did get around to writing the converter I wanted to), but there’s no rush for old news, and I’ve got copies to work from even if I’m not done by April 2.

Posted on
by

This blog has been around 15 years. Social media has mostly moved on, to silos like Facebook and Twitter. People don’t follow random personal blogs. Topic-focused sites are what people actually read, and even that mainly following links from silos.

Meanwhile there are so many major things going on that make the things I post about here — comics, fandom, photos of things I found interesting, random tech thoughts — seem trivial.

So why keep a blog going? And why write about trivialities, and not big things like the battles over civil rights, healthcare, environmental protections, war?

As for the first: Some of it is stubbornness. And some of it is wanting to keep part of my writing/photo presence somewhere “permanent” (to the extent that anything online is).

As for the second: I’ve never really liked talking news and politics online. I rarely feel like I can add anything that hasn’t already been said (probably better) by someone else. Also, online conversation has gotten way too toxic. On the other hand, while the little things may be trivial, they add up. They add up to your life. It feels like I might actually have something to say that’s not already been said a thousand times by people more familiar with the issue than I am.

Plus it’s a way to assert some normality in a world that feels decidedly abnormal.

I’m not likely to come up with anything super-profound on the most important topics, but I can make short statements, and I can amplify other voices. And I’m trying to come to grips with the fact that that’s important. I’ve been reading a lot more and posting a lot less over the past year or so, but even if I can’t say anything profound, I shouldn’t stay silent.

So I’ve been microblogging, and linking, and reposting — all things that are better suited for a service that’s built around those use cases. When I have something longer to say, I do try to pull it in here, because a blog post is better than a Twitter thread… But I think more people probably see my retweets than my blog posts, anyway.

Posted on
by

Back in the old days, before you could upload photos straight to Facebook or Twitter or Tumblr, if you wanted to share pictures online you had to host them yourself. Or if you used something like LiveJournal, you could use their limited image galleries. But with space and bandwidth at a premium in those days, you could run into limits fast.

That’s where sites like Photobucket and Imgur came in. You could upload your images there, and then put them on your fan site, or your journal, or whatever. They were also good for posting anonymously, as in communities like Fandom!Secrets. And they’re still good for posting images in places like Ebay listings, or online forums (yes, they still exist) that don’t provide their own hosting.

But you know the problem with hosting your stuff with a third party. You can’t guarantee they’ll stick around. And while Photobucket isn’t closing up shop yet like GeoCities did (taking with it an entire generation of online fandom), they’ve suddenly blocked hotlinking (the main way people used it!)…unless you pay up $399/year for an advanced account. BuzzFeed minces no words, calling it “ransom”.

So an awful lot of images across the internet have stopped working overnight.

I’m starting to think about all my photos that are hosted on Flickr, now that Verizon owns it. I don’t think they’re likely to do something similar, and Flickr’s paid service is a lot cheaper than Photobucket’s. But Yahoo was never quite sure what to do with it, and Verizon… well…

It might be time to move my “pull in remote Flickr embeds” project off the back burner, just in case.

Posted on
by

The cost of implementing HTTPS on your own site is a lot lower now than it used to be. For instance:

  • Let’s Encrypt offers free certificates for any site, and some web hosts have software integration that make ordering, verifying and installing a certificate as simple as checking a box and clicking a button. (I’m impressed with DreamHost. I turned on secure hosting for some of my smaller sites a few months ago by just clicking a checkbox. It generated and installed the certs within minutes, and it’s been renewing them automatically ever since.)
  • Amazon now has a certificate manager you can use for CloudFront and other AWS services that’s free (as long as you don’t need static IP addresses, anyway) and only takes a few minutes to set up.
  • CloudFlare is offering universal HTTPS even on its free tier. You still need a cert to encrypt the connection between your site and CloudFlare to do it properly, but they offer their own free certs for that. They’ll also let you use a self-signed certificate on the back end if you want. (It’s still not perfect because it’s end-to-Cloudfront-to-End instead of end-to-end, but it’s better than plaintext.)

You may not need a unique IP address anymore. Server Name Indication (SNI) enables HTTPS to work with multiple sites on the same IP address, and support is finally widespread enough to use in most cases. (Unless you need to support IE6 on Windows XP, or really old Android devices.)

Now, if you want the certificate to validate your business/organization, or need compatibility with older systems, you may still want to buy a certificate from a commercial provider. (The free options above only validate whether you control the domain.) And depending on your host, or your chosen software stack if you’re running your own server, you may still have to go through the process of generating a request, buying the cert and going through the validation process, and installing the cert.

But if all you want to do is make sure that your data, and your users’ data, can’t be intercepted or altered in transit when connecting to reasonably modern (2010+) software and devices, it’s a lot less pain than it was even a year ago.

The hard part: Updating all your old links and embedded content. (This is why I’m still working on converting Speed Force and the rest of hyperborea.org in my spare time, though this blog is finally 100% HTTPS.)

And of course dealing with third-party sources. If you connect to someone else’s site, or to an appliance that you don’t control, you have to convince them to update. That can certainly be a challenge.

Expanded from a comment on Apple: iOS to Require HTTPS for Apps by January at Naked Security.

Posted on
by

Sophos reports that Facebook is testing a feature to hide new posts from your timeline so they don’t feel so permanent. Of course they’re still searchable until you actually delete them, so they’re still permanent in that sense.

What’s odd: Facebook posts don’t feel permanent to begin with, even though they effectively stick around forever.

Thinking about it, two things make an internet post feel permanent to me:

  1. Can I count on it sticking around?
  2. Can I count on finding it again?

Facebook, despite a lot of improvements over the years, is a mess. The newsfeed algorithm means you can’t just keep scrolling back. The timeline view isn’t reliably complete. Search is kind of a crap shoot. Don’t get me started on trying to find a particular old post on Twitter!

And that’s dealing with sites I can expect to stay online over time. A post on a forum, or a comment on someone else’s blog, or any social network could easily vanish in someone’s server crash or business shutdown.

If I can’t count on being able to find what I post a few years down the line, it feels like it’s temporary, even if it isn’t.

This is one reason that my Flickr portfolio feels more permanent than my Instagram photos: I can find them without resorting to third-party apps. If I want to find a particular photo on Instagram, I have to page down through my profile until I find it. On Flickr, I can find a 10-year-old photo of a fountain in seconds by searching for “fountain” and expanding the “Your photos” section of the results.

Then again, running my own site is only reliable as long as I can afford it. If something happens to me, and I can’t pay for hosting anymore, what then? I figure I’d simplify things down to where I could get a basic, super-cheap hosting plan. Make the blogs read-only so they can be served statically from a shared server or S3 bucket, or move them to WordPress.com, or just be willing to let them crash under load. But what if I’m incapacitated and can’t convert it? Or just plain not there anymore? If I really want to keep my corner of the web up “permanently,” I’m going to have to make a plan ahead of time.

Otherwise my carefully preserved photos, articles, and extended musings will be toast…leaving behind as context only broken links and all my supposedly (but not really) ephemeral offhand remarks on Twitter and Facebook.